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REMARKS 

In the Requirement for Information under 37 C.F.R. § 1.105, dated January 15, 2010, the 
Examiner requests that Applicant submit references in regards to "... .a number of possible 
classification techniques are known in the art and could be used to initially locate the sub-strings 
in the URL that are candidates for being session identifiers" (Requirement for Information, p. 2). 

In response to the Examiner's request, Applicant submits a copy of the specification of 

co-pending U.S. Patent Application No. 10/672,248, which was filed on September 29, 2003, 

before the filing date of the present application. Applicant respectfully submits that this 

submission satisfies the Examiner's request. For example, paragraphs [0046]-[0053] of U.S. 

Patent Application No. 10/672,248 disclose: 

For web sites in the list of suspicious sites, session ID locator 320 may fetch (download) the home page of 
the corresponding web site two different times (act 602). The home page of a web site can normally be 
accessed by initiating a hyper-text transfer protocol (HTTP) request with the host name. For example, the 
home page of the web site corresponding to the host "google.com" may be downloaded with the HTTP 
request "http://www.google.com". In some implementations, other web documents at the web sites, instead 
of the home page, may be fetched instead. 

If the web site under consideration is one that uses session identifiers, each of the two requests in act 602 
should be returned with a different set of session identifiers. Thus, for example, with reference to Fig. 5, 
the first request to "somecompany.com" may return a web page with links 501-504, each including the 
session identifier "12341234." The second request to "somecompany.com" may return a web page with 
links similar to links 501-504, but including a different session identifier, such as "12345678." 

Session ID locator 320 may extract the set of local (also referred to as in-host) links (URLs) from the web 
pages downloaded in act 602 (act 603). Local links are defined as links that refer back to the web host. 
The exemplary links 501-504 are all local links because they all refer to documents at 
"somecompany.com." If one of the links downloaded from the home page ofsomecompany.com" 
referred to another web host, such as the exemplary link "http://someothercompany.com/home.htm," this 
link may not be considered a local link by session ID locator 320. 

Fig. 7 is a diagram illustrating exemplary sets of links that correspond to a first and second set of links 
downloaded from a home page. In this hypothetical example, the homepage is given as 
"http://somecompany.com/home.htm." The first set of links, set 701, includes four in-host links 702 
and an external link 703. The second set of links, set 710, also includes four in-host links 712 and external 
link 713. 

Session ID locator 320 may next compute the fraction of links that change by comparing the four in-host 
links 702 to the four in-host links 712 (act 604). In this example, the first three of the four links in sets 702 
and 712 contain session identifiers that change between sets 702 and 712. The last link in sets 702 and 712 
does not change between sets. Accordingly, three out of the four links (75%) change between links 702 
and 712. 
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If the fraction determined in act 604 is above a predetermined threshold, session ID locator 320 may 
classify the corresponding web site as one that uses session identifiers (acts 605 and 606). The value to use 
as the threshold may be determined based on manual inspection of typical values calculated for a number of 
web sites. 

Other techniques may be used to classify web sites as ones that use session identifiers. For example, if 
there is at least one link that changes between the two versions of the web page and the content underlying 
these two links are duplicates or near-duplicates of one another, the web site may be considered to be one 
that uses session identifiers. Another technique may be to crawl URLs from a given web site until a certain 
number of pages have been crawled (e.g., 100). At this point, near-duplicate pages could be determined for 
the crawled pages. If the portion of near-duplicates is greater than a predetermined level, the web site 
could be considered to be one that uses session identifiers. 

For sites that session ID locator 320 determines to use session identifiers, session ID rule generator 325 
may analyze the links with session identifiers to determine a rule(s) that the site uses to insert the session 
identifiers (act 607). For the "somecompany.com" example shown in Fig. 7, for example, the rule may be 
determined as "insert the session identifier after the host name and delineate the session identifier with '/' 
characters." In some implementations, session ID rule generator 325 may be implemented manually by 
human operators. In other implementations, automated pattern classification techniques may be used to 
implement session ID rule generator 325. 

To the extent necessary, a petition for an extension of time under 37 C.F.R. § 1.136 is 
hereby made. Please charge any shortage in fees due in connection with the filing of this paper, 
including extension of time fees, to Deposit Account No. 50-1070 and please credit any excess 
fees to such deposit account. 
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